Privacy Policy

Last updated: 2026-10-12 Version: 1.4

1. Data controller

TakeMe, a SASU with share capital of €15,000, registered office at 229 rue de Solférino, 59800 Lille, France (SIREN 993 936 350), represented by its president Valentin Drygas.

Contact: privacy@take-me.fr

2. Data collected

2.1 Data provided directly by the user

• Identity: email, password (hashed), first name, last name, date of birth
• Freelance profile: photo, bio, profession, portfolio, indicative rates, service area (geolocation)
• Professional information (freelancer): SIREN number and company name, links to social networks and other external links, Calendly link
• Client profile: first name, city
• Business client: company name, website, logo
• Billing (freelancer): legal form, intra-EU VAT number, VAT regime, share capital, registration (RCS/RM), billing address, IBAN and BIC
• Quotes and invoices: documents issued by the freelancer, containing the details of both parties (name or company name, SIREN, VAT number, address) and, for invoices, the freelancer's IBAN and BIC
• Payments and subscriptions: subscription plan, status and renewal date, customer and subscription identifiers assigned by Stripe or, for a subscription purchased in the mobile app, transaction identifiers assigned by Apple or Google; amount of escrowed payments for a mission and the transaction references assigned by Stripe. TakeMe never receives or stores payment card data.
• Identity verification (freelancer): verification status and level, identifiers assigned by Stripe. Identity documents are sent directly to Stripe and stored by Stripe, not by TakeMe.
• Communications: messages exchanged with other users, reports
• Missions: title, description, budget, dates, reviews given/received
• Reviews: rating (1 to 5 stars), comment, freelancer's reply
• Files: files exchanged in conversations and files uploaded to the file space built into TakeMe (separate from Google Drive)

2.2 Data collected automatically

• Technical logs: IP address (anonymised), browser, OS
• Audience measurement (PostHog, with explicit consent only), on the website and the mobile app: pages or screens viewed, session duration, without identifying you by name
• Diagnostics: error, crash and performance reports sent to Sentry, without email address or IP address
• Sign-up origin: the platform used to create the account (website, Android or iOS) and, if you arrived through a TakeMe campaign link (take-me.fr/go/…), the name of that link. On Android, this name is provided by the Play Store at install time. A click on such a link only records the device type and country, without cookies, IP address or identifier. This data is used solely for internal, aggregated statistics.
• Push notifications (mobile app): the device's notification token, platform (iOS or Android) and device language
• Platform usage: profile views (profile viewed, viewer, date), last login, merit score indicators (responsiveness, satisfaction, reliability, performance), visibility penalties
• Device location (with your permission): used on demand to centre the map and for the "Near me" search, which converts it into a city name; it is not stored

2.3 Google Calendar data (optional connection)

If a freelancer chooses to connect their Google Calendar account from the Settings page (an optional feature), TakeMe accesses, read-only, the busy time ranges of their primary calendar, via the Google Calendar freeBusy API and the https://www.googleapis.com/auth/calendar.readonly scope. TakeMe never accesses event titles, descriptions, attendees, or any other event content — only "busy / free" time intervals. TakeMe also reads the email address of the connected Google account (https://www.googleapis.com/auth/userinfo.email scope), in order to show the freelancer which account is linked. This processing is detailed in section 7.

2.4 Calendly data (optional connection)

If a freelancer chooses to connect their Calendly account from the Settings page (an optional feature), TakeMe reads the Calendly account's email address and the start and end times of their scheduled events, in order to mark the corresponding time slots as unavailable. No other event content is stored.

3. Purposes

4. Retention period

• Account data: until the account is deleted. As soon as deletion is requested, the account is hidden (profile removed from the map and from searches); it is permanently deleted 30 days later, during which the request can be cancelled. Only the data below, which the law requires us to keep, remains afterwards
• Inactive accounts: an account with no activity at all (sign-in or use of the website or app) for 12 months is permanently deleted. An email warns 30 days beforehand; signing in before that date is enough to keep it. Accounts with a mission or payment in progress, or an active subscription, are not affected
• Login logs: 12 months
• Mission data: 5 years (accounting obligations); after an account is deleted, the deleted person is anonymised in it
• Invoices: 10 years (retention of accounting records, article L123-22 of the French Commercial Code)
• Analytics cookies: 13 months max (CNIL)
• Google Calendar busy ranges: transient retention (rolling 8-week window), refreshed on each synchronisation and deleted when the calendar is disconnected
• Email address of the connected Google account: kept while the calendar is connected, deleted when it is disconnected
• Calendly busy ranges: same rule as Google Calendar

5. Recipients

• TakeMe team (limited access)
• Supabase (hosting, EU — Germany)
• Resend (transactional email, EU)
• Sentry (error monitoring, EU)
• PostHog (analytics, EU — with consent)
• Mapbox (mapping, USA — minimised data: coordinates, and the city or address entered when searching for a place)
• Mistral AI (search-text interpretation and review moderation, EU — see section 8)
• OpenAI (fallback for Mistral AI for the same processing, USA — see section 8)
• Apple (App Store) and Google (Google Play): payment of subscriptions purchased in the mobile app (in-app purchase). Payment is made through Apple or Google; TakeMe never receives card data or payment method details, only the subscription status.
• RevenueCat (tracking of subscriptions purchased in the mobile app: TakeMe account identifier, product purchased, status, start and end dates, store country)
• Stripe (subscription payments, escrowed mission payments and freelancer identity verification, on pages hosted by Stripe; TakeMe never has access to payment card data or identity documents)
• Cloudflare R2 (storage of files exchanged in conversations and of the file space, hosted in the EU)
• Expo (delivery of push notifications to iOS and Android devices: device token and notification text)
• Calendly (optional availability synchronisation, at the freelancer's initiative — see section 2.4)
• Recherche d'entreprises API (recherche-entreprises.api.gouv.fr, a French government service: SIREN number verification)

Google Calendar data (section 2.3) is shared with none of these recipients, nor with any other third party (see section 7).

6. Transfers outside the EU

• Mapbox is hosted in the United States. The only data transmitted is the geographic coordinates needed to render the map, and the city or address entered when searching for a place. Contractual safeguards: Mapbox Standard Contractual Clauses (SCC).
• OpenAI (used only as a fallback for Mistral) is hosted in the United States. The only data transmitted is the user's search text and the text of reviews to be moderated (see section 8). Contractual safeguards: Standard Contractual Clauses (SCC).
• Stripe: the contract is with Stripe Payments Europe (Ireland), but some data may be transferred to Stripe, Inc. in the United States. Data concerned: the account email address, the information entered on the Stripe-hosted payment pages and, for freelancers, the information and documents sent to Stripe for identity verification and payouts. Safeguards: EU–U.S. Data Privacy Framework and Standard Contractual Clauses (SCC).
• RevenueCat (RevenueCat, Inc.) is hosted in the United States. Data transmitted: TakeMe account identifier and subscription information from the App Store and Google Play (product, status, dates). Safeguards: EU–U.S. Data Privacy Framework and Standard Contractual Clauses (SCC).
• Expo (push notification delivery) is hosted in the United States. Data transmitted: the device notification token and the notification content. Contractual safeguards: Standard Contractual Clauses (SCC).

No Google Calendar data is transferred outside the EU (nor, within the EU, to any third party): it is stored only with Supabase (EU).

7. Google Workspace API data (Google Calendar): access, sharing & Limited Use

• Data concerned: the "busy" time ranges of the freelancer's primary calendar, obtained via the Google Calendar freeBusy API with the https://www.googleapis.com/auth/calendar.readonly scope (read-only), and the email address of the connected Google account (https://www.googleapis.com/auth/userinfo.email scope), used only to show the freelancer which account is linked. No event content (title, description, guests, location) is read or stored.
• Sole purpose: to mark the corresponding time slots as unavailable in the freelancer's availability, in order to prevent double bookings.
• With whom this data is shared, transferred, or disclosed: with no one outside TakeMe. It is stored only in our Supabase database (hosted in the EU) and is never transmitted to any third party — not to Mapbox, PostHog, Resend, Sentry, Mistral, OpenAI, or any other service or artificial-intelligence service.
• No AI/ML training: this data is never used, transferred, or sold to create, train, or improve artificial-intelligence or machine-learning models, whether generalised or specialised.
• Revocation: the freelancer can disconnect their calendar at any time from the Settings page; the corresponding busy ranges are then deleted.
• Limited Use statement: TakeMe's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

8. Artificial-intelligence (AI/ML) processing

TakeMe uses AI models for three purposes:

• to interpret the free-text search entered by a client (and requests for new professions) in order to extract the profession, city, and budget being sought;

• to avoid duplicates among expertise domains and skills: when a freelancer is about to create a new one, the term entered is compared with existing ones, to suggest the one with the same meaning under another name;

• to moderate reviews: the text of a review and its rating are analysed to flag suspicious content (contact details, insults, spam, off-topic content). The result only annotates the moderation queue: the decision to publish or reject a review remains with a member of the TakeMe team.

• Providers: Mistral AI (mistral-small-latest, hosted in the EU) as primary; OpenAI (gpt-4o-mini) as a fallback when Mistral is unavailable. Access is via their paid commercial ("pay-as-you-go") APIs.

• Data transmitted: only the search text, profession request or domain or skill to be created, entered by the user, and the text and rating of reviews to be moderated. No Google Calendar data, no calendar data, and no Google Workspace content is ever transmitted to these services.

• No training: in accordance with the API terms of Mistral and OpenAI, data sent via their API is not used to train their models.

• Your consent: nothing is sent to these services without your explicit consent, requested the first time you use each feature (smart search, reviews, profession requests, domains and skills). You can withdraw it at any time in Settings > Security. Without consent, filter search remains available, your review is checked only by our team, you pick your profession from the list, and only similarly spelled terms are suggested before you create one.

9. Your GDPR rights

You have the following rights:

• Access: know what data is processed (JSON export available in /settings)
• Rectification: edit your data via your profile
• Erasure: delete your account from the app or /settings (account hidden immediately, permanently deleted after 30 days)
• Portability: JSON export available in /settings
• Objection: refuse analytics cookies (consent banner)
• Restriction: on request to privacy@take-me.fr
• Withdraw consent: at any time via /settings (including disconnecting Google Calendar)

To exercise these rights: privacy@take-me.fr. Response within 1 month.

Complaints: your national data protection authority (in France: CNIL — https://www.cnil.fr/en/plaintes).

10. Security

• Hashed passwords (bcrypt)
• HTTPS enforced
• Postgres RLS (Row-Level Security) on all tables
• 2FA for administrators

11. Cookies

Categories:

• Necessary: auth session (always active)
• Analytics: PostHog (opt-in)

12. Changes

This policy may evolve. Email notification for substantial changes.